Work out what is actually exposed
- Does it hold real customer data, or placeholder content
- Is there an admin login, and does it share credentials with production
- Is there an API or database reachable from it
- Is it indexed by search engines, meaning it can be found without looking for it
- Is the software on it patched, or has it been untouched since it was created
A forgotten staging site running four-year-old software with a copy of the production database is a serious problem. One serving placeholder text is untidy. Both should go, with different urgency.
Restrict it
- Fastest fix: take it offline entirely if nobody is using it. Most of these are not in use.
- If it is in use: put HTTP basic authentication in front of it. One line in most web server configurations, and it stops both search engines and casual visitors.
- Better: restrict by IP address to your office and VPN, so it is not reachable from the public internet at all.
- Not sufficient on its own: a robots.txt file. It asks well-behaved crawlers not to index and does nothing to stop anyone reading the site.
Remove it from search results
- Restrict access first. Removal requests on a page that is still public are pointless.
- Use the removal tool in Google Search Console for the property, and the equivalent in Bing Webmaster Tools.
- Expect it to take days rather than minutes, and check afterwards rather than assuming.
Why they accumulate
A staging site is created for a specific piece of work, that work finishes, and removing it is nobody's task. The person who made it has moved on and the person who inherits the domain does not know it exists. That is precisely why it shows up in a check rather than in anyone's memory.